Cookie Policy

Data controller: AI Finance Association Europe • Contact: aifae.org@gmail.com • Status: 2026-09-09 • GA4 · Stripe · RevenueCat · Apple IAP · Google Play

1. What are cookies?

Cookies are small text files that are stored by a website on your device (computer, smartphone, tablet). They allow certain information to be retained between your visits so that the website functions correctly and you get a better user experience.

In addition to classic cookies, similar technologies can also be used, for example local storage (a browser-side data storage) or session storage. These mechanisms also fall under the ePrivacy Directive and Section 165 Paragraph 3 TKG 2021.

2. What cookies and technologies does Permutis use?

Permutis divides cookies and similar technologies into four categories. The following table provides an overview of the purpose, examples, typical storage period and consent.

Category	Purpose	Examples	Typical storage period	Consent required?
Necessary	Basic functions of the website: language selection, remembering cookie consent, session and login control.	`permutis_cookie_consent`, `permutis_lang`, `permutis_session`	`permutis_cookie_consent`: maximum 12 months, then another query. `permutis_lang`: until manual deletion. `permutis_session`: is based on the token`expires_at` (see § 3b).	No – technically required
Functional / Preferences	Stores optional views, the colour scheme and convenience settings after your consent.	App settings and preference entries (see § 3b)	Until manual deletion	Yes – convenience, without data for advertising purposes
Analytics / Statistics	Google Analytics 4 measures page views and usage with pseudonymous identifiers. It loads only after your analytics consent.	Google Analytics 4 (GA4) `_ga` · `_ga_*`	Up to 24 months (after activation)	Yes
Marketing	Attributes a registration to an affiliate link after your marketing consent. Personalised advertising is currently disabled.	Permutis `permutis_affiliate_ref`	Until the browser tab is closed.	Yes

Necessary: permutis_lang, permutis_cookie_consent, permutis_session. Analytics / Statistics: Google Analytics 4 measures page views and usage with pseudonymous identifiers. It loads only after your analytics consent. _ga · _ga_*

3. Necessary memory entries in detail

Permutis places the following entries in the browser's local storage without consent because they are technically absolutely necessary for the operation of the website:

name	Purpose	Location	Duration
`permutis_cookie_consent`	Saves your cookie settings (version, timestamp, categories) so that the banner does not appear again each time you visit.	Local Storage	Maximum 12 months from storage; The banner will then be displayed again and will require fresh consent. Early deletion is possible at any time (see § 5).
`permutis_lang`	Saves the selected language of the website so that it is retained the next time you visit.	Local Storage	Until manual deletion or until the browser data is cleared.

3a. Browser storage

The table describes browser storage. Sign-in and contractual steps you explicitly start are necessary; optional preferences, analytics and affiliate attribution require the corresponding consent.

key	Location	Purpose	Lifespan	Necessary?
`permutis.hero.place.v1`	localStorage	Approximate place selected for the homepage and nearby offers; up to 30 days, removable with “Reset place”.	Up to 30 days	Optional
`permutis.hero.variant.v1`	sessionStorage	Remembers the last text variant shown so that the homepage uses different wording on your next visit in the same tab.	Until the browser tab is closed.	Functional
`permutis_cookie_consent`	Local Storage	Remember cookie consent (version, timestamp, categories).	Maximum 12 months, then another query.	Yes
`permutis_lang`	Local Storage	Selected UI language of the website.	Until manual deletion or until the browser data is cleared.	Yes (language choice)
`permutis_session`	Local Storage	Supabase auth session: `access_token`, `expires_at`, `user`. Renewed by the client before expiration; immediately removed upon logout.	Until token`expires_at` (set by the auth service) or until explicit logout.	Yes (login)
`permutis_refresh_token`	Session storage	Supabase auth session: `refresh_token`	Until the browser tab is closed.	Yes (login)
`permutis_session_bridge`	Session storage	One-time sign-in handover to the app, valid for 120 seconds. Deleted when consumed or on sign-out.	Until the browser tab is closed.	Yes (login)
`permutis-theme`	Local Storage	Stores optional views, the colour scheme and convenience settings after your consent.	Until manual deletion or until the browser data is cleared.	Functional
`permutis_oauth_verifier`	Session storage	PKCE-`code_verifier` for the ongoing OAuth/Magic Link handshake. Will be removed after a successful callback.	Until the browser tab is closed or until the callback is successful.	Yes (OAuth)
`permutis_fav_view`	Local Storage	Preferred display of favorites (grid/list).	Until manual deletion or until the browser data is cleared.	Functional
`permutis_last_withdrawal_request`	Local Storage	Saves the last revocation reservations (contract type, reference, timestamp) so that the message “revocation prepared” can be displayed again after a reload.	Until manual deletion; will be overwritten with each new revocation.	Functional / Preferences
`permutis.postLogin.displayedOffers.<userId>`	Local Storage	Remembers up to 1,200 recently viewed offer IDs per user so that the post-login order favors fresh offers.	Until manual deletion or until the browser data is cleared. Will be reset upon logout.	Functional
`permutis_msg_archived_<userId>`	Local Storage	Note per user which Messenger conversations are locally marked as “archived” (reversible).	Until manual deletion or until the browser data is cleared.	Functional
`permutis_msg_hidden_<userId>`	Local Storage	Note per user which Messenger conversations are hidden locally; is automatically reset as soon as a new message arrives.	Until manual deletion or until the browser data is cleared.	Functional
`permutis_affiliate_ref`	Session storage	Passes the referral code from affiliate links to the actual sign-up/login request. Will be removed after successful attribution.	Until the browser tab is closed or until the attribution is successful.	Marketing
`permutis_pending_founder_checkout`	Session storage	Provides the payload for a started Founders Club checkout between steps so that Stripe plus the subsequent success page can process the identical selection.	Until the browser tab is closed or checkout is completed.	Yes

Withdrawal stops further optional storage access and deletes the corresponding entries in this browser. It does not recall data already transmitted.

Map and QR libraries are hosted by Permutis. Map images load from OpenStreetMap, which receives your IP address and technical request data. See the privacy notice for details.

3b. Term guarantees for cookie consent

The consent period is technically strictly limited so that your decision is regularly reviewed and not tacitly extended:

Maximum duration 12 calendar months: The timestamp in the timestamp field is checked against timestamp + 12 Monate when reading. After the deadline has expired, the system no longer considers the consent to exist and shows the banner again.
Version change: When a new policy version comes into effect (CONSENT_VERSION in cookie-consent.js), the saved entry will be discarded and you will be asked again.
Tamper protection: Invalid or future timestamps are discarded so that local manipulation cannot switch off the process.
Revocation: You can withdraw your consent at any time via the footer link “Cookie Settings” or by manually deleting the browser data for permutis_cookie_consent (see § 5).

Recipients and processors

The matrix and the AI section describe the recipients and their tasks. Order processing requires a contract in accordance with Article 28 GDPR. Payment and app store providers also process certain data under their own responsibility. You can obtain information about the recipients and protection agreements that apply to your process via our data protection contact.

Provider	Role	Purpose	Third-country transfer
Google Firebase (permutis-bf6cb) / Google Analytics 4 `_ga` · `_ga_*`	Processor	Google Analytics 4 measures page views and usage with pseudonymous identifiers. It loads only after your analytics consent.	International processing, including USA, possible; see third country transfers.
Stripe Payments Europe Ltd. `__stripe_mid` · `__stripe_sid` · `_GRECAPTCHA`	Independent controller	Web checkout for subscriptions/credits/Founders Club	International processing, including USA, possible; see third country transfers.
RevenueCat Inc.	Processor	Mobile subscription wrapper (Apple IAP / Google Play Billing)	International processing, including USA, possible; see third country transfers.
Apple App Store / Apple Distribution International Ltd.	Independent controller	iOS distribution, IAP	International processing, including USA, possible; see third country transfers.
Google Play / Google Ireland Ltd.	Independent controller	Android distribution, billing library	International processing, including USA, possible; see third country transfers.

Native apps do not set browser cookies. After consent, Firebase Analytics uses an app-instance ID; RevenueCat, Apple IAP and Google Play Billing process the app user ID, purchase receipt or purchase token and entitlement status for mobile platform purchases. Local SDK caches and app settings are managed in device storage.

Stripe Cookie Settings · Google Analytics Cookie Usage

4. Opt-in for non-essential cookies

Cookies in the functional, analysis and marketing categories are only set and corresponding scripts are only loaded if you expressly agree. Consent is given via the cookie banner or the settings mask that appears on the first visit.

No tracking scripts, analysis pixels or marketing libraries will be loaded without your consent. Necessary cookies are excluded.

If you agree to functional cookies, Permutis can also use preference data to better sort suitable offers or improve matching suggestions. This may include saved search filters, radius, categories, language, wish list views or similar convenience settings. Without this consent, core matching remains possible, but less personalized comfort functions may be restricted.

5. Revoke or change consent

You can adjust your consent or revoke it completely at any time. The following options are open to you:

Reopen cookie settings: Click on the link (in the footer of every page or directly here).
Browser settings: You can delete all cookies or generally block the setting of cookies in your browser settings. Please note that this will also remove necessary entries and the website may no longer function fully.

A revocation does not affect the lawfulness of the processing that took place based on your consent before the revocation.

6. Legal basis

Storage on or access to your device that is strictly necessary falls under the exception in section 165, paragraph 3 of the Austrian Telecommunications Act 2021 (TKG 2021). Processing personal data for account functions you request is based on Article 6, paragraph 1, point (b) of the GDPR; necessary security measures are based on our legitimate interest under Article 6, paragraph 1, point (f) of the GDPR. Other purposes and legal bases are described in the privacy notice.

We use optional functional storage and analytics or marketing technologies only with your consent under Article 6, paragraph 1, point (a) of the GDPR and section 165, paragraph 3 of the Austrian Telecommunications Act 2021 (TKG 2021).

7. Further information

You can find detailed information about which personal data Permutis processes, on what legal basis and what rights you are entitled to in our .

If you have any questions about this Cookie Policy, please contact: aifae.org@gmail.com